RPCFW

Sigma (17)

• Possible DCSync Attack severity high T1033
• Recon Activity via SASec severity high
• Remote DCOM/WMI Lateral Movement severity high T1021,T1021.003,T1047
• Remote Encrypting File System Abuse severity high
• Remote Event Log Recon severity high
• Remote Printing Abuse for Lateral Movement severity high
• Remote Registry Lateral Movement severity high T1112
• Remote Registry Recon severity high
• Remote Schedule Task Lateral Movement via ATSvc severity high T1053,T1053.002
• Remote Schedule Task Lateral Movement via ITaskSchedulerService severity high T1053,T1053.002
• Remote Schedule Task Lateral Movement via SASec severity high T1053,T1053.002
• Remote Schedule Task Recon via AtScv severity high
• Remote Schedule Task Recon via ITaskSchedulerService severity high
• Remote Server Service Abuse severity high
• Remote Server Service Abuse for Lateral Movement severity high T1569,T1569.002
• SharpHound Recon Account Discovery severity high T1087
• SharpHound Recon Sessions severity high T1033